When attempting to authenticate using API token, an ephemeral user record was created to validate the token in case an external security realm was used, and the user record in Jenkins not previously saved, as (legacy) API tokens could exist without a persisted user record.

This behavior could be abused to create a large number of ephemeral user records in memory.

This is the same vulnerability as SECURITY-672. The fix for SECURITY-672 was previously incorrectly applied and therefore not effective. This has been fixed.


External References:

https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1162